Real IP addresses in the log?

[mxm199]

Good day to everyone, looking for help, tips

In short, there is such a scheme of the home network There is nothing between the router and NPM, just a direct port forwarding to the container with the NPM (192.168.0.200 80, 443).

Used docker-compose -

version: '3.8'
services:
  app:
    image: 'jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    container_name: nginx-proxy-manager
    ports:
      - '80:80'
      - '443:443'
      - '4488:81'
    environment:
      DB_HOST: "db"
      DB_PORT: 5432
      DB_USER: $(DB_USER)
      DB_PASSWORD: $(DB_PASSWORD)
      DB_NAME: $(DB_NAME)
      DISABLE_IPV6: 'true'
      X_FRAME_OPTIONS: "sameorigin"
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt
    depends_on:
      - db
    healthcheck:
      test: ["CMD", "/bin/check-health"]
      interval: 10s
      timeout: 3s
    networks:
      dockernet:
        ipv4_address: 172.16.0.2
  db:
    image: 'postgres:13'
    restart: unless-stopped
    container_name: nginx-proxy-manager-db
    environment:
      POSTGRES_USER: $(POSTGRES_USER)
      POSTGRES_PASSWORD: $(POSTGRES_PASSWORD)
      POSTGRES_DB: $(DB_NAME)
    volumes:
      - pg-data:/var/lib/postgresql/data
    networks:
      dockernet:
        ipv4_address: 172.16.0.3
volumes:
  pg-data:
networks:
  dockernet:
    external: true

A network has been created docker network create --subnet=172.16.0.0/24 dockernet

Hosts have been added to NPM, everything works fine, full Internet access to all resources

To view logs, I use goaccess (xavierh/goaccess-for-nginxproxymanager). But the whole problem is that only one client address appears everywhere in the log - 172.16.0.1 (takes information (parses) for display directly from the npm logs folder).

Is it possible on this configuration to ensure that the logs display the real addresses of connecting clients? All the options found on the Internet and suggested by chatgpt :) did not help me. It’s possible, of course, to configure the router settings, but I didn’t find anything suitable in the standard firmware...

[netstx]

You can add custom NGINX config to the proxy host so that it adds headers to pass through the correct IP to origin server. If you search issues (open/closed) you may find some examples.

[mxm199]

But how to add a custom configuration to nginx itself, because the address 172.16.0.1 (gateway address) is displayed in its logs itself, and it makes no sense to add configurations to proxy hosts. Yes, I probably need an example, but I haven't found one yet. And is it possible, the Internet says that this is a limitation when deploying docker on Windows systems. Is it so?

[dayueba]

container network should be host not bridge

[trisweb]

Encountering this as well, just want to add: it's very unexpected that every service I proxy to sees only my router IP as the client IP. It would be great to have a simple option for proxy hosts to set these headers for convenience.

[leonida92]

I fixed it just by adding this line:

real_ip_header X-Forwarded-For;

in the advanced section of the proxy host. At least it works for my usecase.

[naanlizard]

I'm not sure why real_ip_header is allowed to be set in the advanced section, but unfortunately there's no way to set that for every proxy host (the advanced config file for proxy servers throws an nginx error if you try, because the real_ip_header is already set in the base http server in the real_ip_header section)

A quick docker exec nginxproxymanager-container-name sed -i 's/real_ip_header X-Real-IP;/real_ip_header X-Forwarded-For;/' /etc/nginx/nginx.conf && docker restart nginxproxymanager-container-name fixes this, and fixes access lists not working with cloudflare as well.

I'm not sure why this bug is allowed to exist, it's pretty bad if you want to use the cloudflare proxy or generally get accurate IP addresses from your clients

[thezoggy]

was going crazy trying to figure out why access lists in nginxproxymanager just would never work.

found a few different ghi where you think oh its just bugs with it not applying config or how it applies it.. tried restarting or various other solutions but no go. eventually debug to find out that its: https://github.com/NginxProxyManager/nginx-proxy-manager/blob/develop/docker/rootfs/etc/nginx/nginx.conf#L68

thought maybe i could override by just doing custom/http_top.conf with "real_ip_header X-Forwarded-For;" but sadly wont work.

then found this ghi which was exact same issue, and can confirm the only fix is to go add it as advanced config for each proxy host. that way the actual real remote ip shows up and the acl work as expected.